diff --git a/project/roadmap.md b/project/roadmap.md
index 658ed79..9a09713 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -14,7 +14,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 2: Network Hardening & Perimeter Defense
 - [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
 - [x] Configure Private Service Connect (PSC) for all Google APIs.
-- [x] Deploy Cloud Armor WAF policy.
+- [x] Enforce IAP-only SSH and restrict Cloud Run ingress.
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index fc70298..1c405d6 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -23,3 +23,7 @@
 - **Task 2.3: Deploy Cloud Armor WAF**
   - Status: **Complete**
   - Notes: Created `tyr-armor-policy` with XSS, rate-limiting, and default-deny rules.
+
+- **Task 2.4: Harden Ingress**
+  - Status: **Complete**
+  - Notes: Replaced default SSH rule with IAP-only rule and set Cloud Run ingress to internal.